aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* duplicheck: Include required headers for FreeBSDDenis Volpato Martins2016-03-031-0/+2
| | | | Closes strongswan/strongswan#34.
* charon: Add custom logger to daemonThomas Egerer2016-03-014-43/+336
| | | | | | | | | | | This logger can be used to easily register custom logging instances using __attribute__((constructor)) benefiting from the global reload mechanism (with reset of log levels). Note that this is not intended to be used from plugins, which are loaded after loggers have already been initialized. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* vici: Correctly document 'up' key for updown eventsTobias Brunner2016-03-011-4/+4
| | | | Instead of sending 'no' it is omitted when an SA goes down.
* ikev2: Use config value for sending of vendor IDsThomas Egerer2016-03-011-13/+43
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* swanctl: Fix minor typos in documentationChris Patterson2016-02-291-3/+3
| | | | | | "UPD" should be "UDP". Signed-off-by: Chris Patterson <pattersonc@ainfosec.com>
* testing: Added swanctl/shunt-policies-nat-rwAndreas Steffen2016-02-2812-0/+231
|
* testing: Some minor fixes in test scenariosAndreas Steffen2016-02-282-0/+3
|
* Version bump to 5.4.0dr75.4.0dr7Andreas Steffen2016-02-281-1/+1
|
* testing: Added swanctl/protoport-dual scenarioAndreas Steffen2016-02-289-0/+142
|
* testing: converted af-alg scenarios to swanctlAndreas Steffen2016-02-2625-149/+198
|
* testing: Use absolute path to the _updown script in SQL scenariosTobias Brunner2016-02-1747-55/+55
| | | | | | /usr/local/sbin is not included in PATH set by the charon init script and since the ipsec script is obsolete when using swanctl it makes sense to change this anyway.
* ike-sa-manager: Store a reference to the thread that checked out an IKE_SATobias Brunner2016-02-171-13/+14
| | | | | | This could be helpful when debugging deadlocks that manifest around wait_for_entry(), as it helps identifying other involved threads (the thread object is seen in the thread_main() call in each thread's backtrace).
* testing: Increased ping interval in ikev2/trap-any scenarioAndreas Steffen2016-02-161-5/+5
|
* Version bump to 5.4.0dr65.4.0dr6Andreas Steffen2016-02-161-1/+1
|
* Corrected the description of the swanctl/dhcp-dynamic scenarioAndreas Steffen2016-02-161-1/+1
|
* Fix of the mutual TNC measurement use caseAndreas Steffen2016-02-1617-28/+234
| | | | | | | | | | | | | | | | | If the IKEv2 initiator acting as a TNC server receives invalid TNC measurements from the IKEv2 responder acting as a TNC clienti, the exchange of PB-TNC batches is continued until the IKEv2 responder acting as a TNC server has also finished its TNC measurements. In the past if these measurements in the other direction were correct the IKEv2 responder acting as EAP server declared the IKEv2 EAP authentication successful and the IPsec connection was established even though the TNC measurement verification on the EAP peer side failed. The fix adds an "allow" group membership on each endpoint if the corresponding TNC measurements of the peer are successful. By requiring a "allow" group membership in the IKEv2 connection definition the IPsec connection succeeds only if the TNC measurements on both sides are valid.
* kernel-netlink: Allow Netlink send buffer size to be configured via compile ↵Tobias Brunner2016-02-121-3/+11
| | | | | | | option The receive buffer size can already be changed via strongswan.conf if necessary.
* utils: Add enum name for pseudo log group 'any'Tobias Brunner2016-02-052-12/+7
|
* libipsec: Pass the same data to del_policy() as to add_policy()Tobias Brunner2016-02-044-12/+17
| | | | | | We already do this for the other kernel interfaces. Fixes e1e88d5adde0 ("libipsec: Don't attempt deletion of any non-IPsec policies")
* libipsec: Don't attempt deletion of any non-IPsec policiesTobias Brunner2016-02-041-1/+1
| | | | | | | | An example are the fallback drop policies installed when updating SAs. We ignore such policies in add_policy() so there is no point in attempting to remove them. Since they use different priorities than regular policies this did not result in policies getting deleted unintentionally but there was an irritating log message on level 2 that indicated otherwise.
* testing: Added swanctl/dhcp-dynamic scenarioAndreas Steffen2016-02-0315-0/+279
|
* ikev2: Add debug message about failed IKE authenticationThomas Egerer2016-02-021-0/+4
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* ikev1: Log successful authentication with signature schemeThomas Egerer2016-02-014-7/+7
| | | | | | Output is now identical to that of the IKEv2 pubkey authenticator. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* peer-cfg: Set DPD timeout to at least DPD delayTobias Brunner2016-02-011-0/+4
| | | | | | If DPD timeout is set but to a value smaller than the DPD delay the code in task_manager_v1.c:queue_liveliness_check will run into an integer underrun.
* ikev1: Always enable charon.reuse_ikesaTobias Brunner2016-02-012-3/+3
| | | | | | | | | With IKEv1 we have to reuse IKE_SAs as otherwise the responder might detect the new SA as reauthentication and will "adopt" the CHILD_SAs of the original IKE_SA, while the initiator will not do so. This could cause CHILD_SA rekeying to fail later. Fixes #1236.
* load-tester: Register kernel-ipsec implementation as plugin featureTobias Brunner2016-02-011-10/+11
| | | | | | | | | | | Otherwise, libcharon's dependency on kernel-ipsec can't be satisfied. This changed with db61c37690b5 ("kernel-interface: Return bool for kernel interface registration") as the registration of further kernel-ipsec implementations now fails and therefore even if other plugins are loaded the dependency will not be satisfied anymore. References #953.
* child-rekey: Suppress updown event when deleting redundant CHILD_SAsTobias Brunner2016-02-011-1/+10
| | | | | | | | | When handling a rekey collision we might have to delete an already installed redundant CHILD_SA (or expect the other peer to do so). We don't want to trigger updown events for these as neither do we do so for successfully rekeyed CHILD_SAs. Fixes #853.
* testing: Don't attempt to start the daemon twice in ha/active-passive scenarioTobias Brunner2016-02-011-1/+0
|
* ha: Properly sync IKEv1 IV if gateway is initiatorTobias Brunner2016-02-011-12/+16
| | | | | | | | | | | | | | To handle Phase 2 exchanges on the other HA host we need to sync the last block of the last Phase 1 message (or the last expected IV). If the gateway is the initiator of a Main Mode SA the last message is an inbound message. When handling such messages the expected IV is not updated until it is successfully decrypted so we can't sync the IV when processing the still encrypted (!plain) message. However, as responder, i.e. if the last message is an outbound message, the reverse applies, that is, we get the next IV after successfully encrypting the message, not while handling the plain message. Fixes #1267.
* ha: Add DH group to CHILD_ADD messageTobias Brunner2016-02-012-1/+12
| | | | References #1267.
* ha: Add DH group to IKE_ADD messageTobias Brunner2016-02-014-0/+16
| | | | | | | | It is required for IKEv1 to determine the DH group of the CHILD SAs during rekeying. It also fixes the status output for HA SAs, which so far haven't shown the DH group on the passive side. Fixes #1267.
* ike-sa-manager: Don't update entries for init messages after unlocking segmentTobias Brunner2016-02-011-3/+2
| | | | | | | | | | | | | If the retransmit of an initial message is processed concurrently with the original message it might not have been handled as intended as the thread processing the retransmit might not have seen the correct value of entry->processing set by the thread handling the original request. For IKEv1, i.e. without proper message IDs, there might still be races e.g. when receiving a retransmit of the initial IKE message while processing the initiator's second request. Fixes #1269.
* unit-tests: The pseudonym RDN is now recognized, so use something more exoticTobias Brunner2016-01-281-3/+3
|
* Version bump to 5.4.0dr55.4.0dr5Andreas Steffen2016-01-281-1/+1
|
* Support pseudonym RDNAndreas Steffen2016-01-273-0/+5
|
* testing: Added swanctl/config-payload scenarioAndreas Steffen2016-01-1412-0/+219
|
* testing: Use include statement in swanctl/rw-pubkey-keyid scenarioAndreas Steffen2016-01-143-30/+19
|
* Version bump to 5.4.0dr45.4.0dr4Andreas Steffen2016-01-101-1/+1
|
* vici: Support multiple named raw ublic keysAndreas Steffen2016-01-101-15/+19
|
* testing: swanctl/rw-pubkey-anon uses anonymous public keys in remote access ↵Andreas Steffen2016-01-0920-0/+297
| | | | scenario
* swanctl: Load pubkeys with load-credsAndreas Steffen2016-01-092-6/+8
|
* testing: added swanctl scenarios net2net-pubkey, rw-pubkey-keyid and rw-dnssecAndreas Steffen2016-01-0955-0/+824
|
* vici: list-cert sends subject, not-before and not-after attributes for pubkeysAndreas Steffen2016-01-094-6/+65
|
* vici: Support of raw public keysAndreas Steffen2016-01-099-20/+110
|
* testing: Fixed description of swanctl/frags-iv4 scenarioAndreas Steffen2016-01-091-4/+4
|
* swanctl.conf: IKEv2 fragmentation supportedAndreas Steffen2016-01-091-8/+9
|
* Version bump to 5.4.0dr35.4.0dr3Andreas Steffen2016-01-031-1/+1
|
* vici: Enable transport encoding of CERT_TRUSTED_PUBKEY objectsAndreas Steffen2016-01-031-5/+8
|
* testing: Change sql scenarios to swanctlAndreas Steffen2016-01-03180-398/+454
|
* testing: Fix some IKEv1 scenarios after listing DH groups for CHILD_SAsTobias Brunner2015-12-214-8/+8
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 23:11:12 +0000